“Not so fast!” cried privacy advocates and parents when California federal judge Kimberly Mueller ordered the release of a huge database of personally identifiable student information to a group of plaintiffs’ lawyers.

Morgan Hill Concerned Parents v. California Department of Education is a lawsuit filed in 2011 that alleges that California schools have failed to meet the minimum educational program requirements for special needs children set forth in the Individuals with Disabilities Education Act (IDEA).  In that lawsuit, the parents of special needs children have been seeking access to a database of student information on 10 million California school children maintained by the California Department of Education (CDOE).  The stated reason for the request for the data was so that the plaintiff lawyers and their experts could do comparative statistical analysis on children’s educational needs and progress to support their claim that there was a systemic failure of the California schools to adequately educate those with special needs.

But when Judge Mueller on February 1, 2016 ordered the release of the records, the backlash was immediate and profound.  Judge Mueller had ordered that a process be provided for any affected parent to file a written objection if the parent wanted to opt out of the data production, as is required by the federal Family Educational Rights and Privacy Act (FERPA).  The number of responses by concerned parents was so great that the court could not even process the objections.

The type of information in the CDOE database is very sensitive. It includes student and teacher names and addresses, disciplinary records, addiction and mental health records, and criminal histories.  So on March 3, 2016 Judge Mueller reconsidered her order that CDOE produce the database, and issued a new order. She ruled that the records will remain solely with the CDOE, and that the CDOE will be required to assist the plaintiffs’ lawyers in accessing the information they need without actually transferring the personally identifiable information.

In her opinion, Judge Mueller noted that FERPA and its privacy requirements and protections were passed into law in 1974, long before the digital age. It is an antiquated, though well-intended, piece of legislation that badly needs to be overhauled to reflect the realities of digitized information. This case is worth following to see how a federal court trying to enforce one set of laws is also trying to navigate another set of privacy laws that could have significant impact on the safety and security of student and teacher personal data nationwide.